As experts in the darknet, we continually monitor developments around sources of darknet content, whether that means sources are coming online or going off line. In the case of Ex0du$ (exoduockgfq3ikf7[.]onion), a darknet discussion board focused around hacking, malware and other similar subjects, this may mean going offline.

What is Ex0du$?

The Ex0du$ Landing Page

Ex0du$ included a discussion forum and marketplace to purchase digital goods. The registration for the forum was occasionally open, but activating an account was an arduous process, involving paying for a membership with bitcoin transfer, obtaining a free membership which required 3 references from existing members, or directly applying for a free membership by following the steps outlined below by the administrators. In the box below, you can see what was received upon applying directly for a free membership account (copied directly with spelling errors).

According to reddit forums, most applicants were unable to successfully complete this process, and even those who paid for the registration were often banned shortly thereafter, typically without explanation. The most common successful route to obtain an account with Ex0du$ was by being vouched for by existing members.

Ex0du$ disappears unexpectedly

Oddly, about a week or so ago (late September), Ex0du$ disappeared from Tor without explanation. Other than a few, “what happened” posts on Hidden Answers and reddit, the darknet has remained relatively quiet about the site’s offline status. A rumored “goodbye” message was posted on the claymore onion domain, but said message now redirects to a new forum, called Apex.

On September 22 2017, a member and moderator who goes by the alias of bl00d, pasted the following note on the Tor-based paste site, Stronghold Paste:

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256

Ex0du$: The End

http://claymormoeepchui.onion/goodbye.html

Date: Friday, Sept 22nd 2017

It's been about 36hrs since Ex0du$ went offline. No word from the admins. At this point, we can safely assume it's not going to return. No one expects any onion site to persist forever, but a simple "hey, bl00d, btw, we're totally about to Houdini this b%!ch... mk, byeeeee" would've been appreciated :P. I'm just pissed they shutdown before I could achieve my life's goal of reaching 300 Rep. 295, so f*%$#g close! Jerks. Leaving the forum and private key to me might've been a better option for everyone too. What's everyone supposed to do now, migrate to KA? Hmm, yeah, I'll pass on that copy/paste news portal run by a dyslexic 14 yr old. No thanks.

I sincerely hope someone from this community decides to start something new. Onionland is dying and needs a proper hacker scene. Someone bring it to life! A few members have requested I start a forum, but I think it would require too much effort and maintenance. I neglect Claymore and other side-projects as it is. :/

PSA: if you have anything stored in my awesome pastebin, now is the time to save that data locally! DraculaPaste will be taken offline sometime before Oct 7th. Claymore will likely be shutdown shortly after (not sure yet exactly when). If you would like to reach me, see Contact info (updated) in the footer.

I've also decided to bring an end to this vampires reign. I shall soon retreat to my luxurious coffin for a millennium of lucidly hallucinogenic dreams. To every interesting h4xx0r I've met who serendipitously discovered Claymore, thank you for everything. To Ex0du$, it's been wonderful knowing all of you. We've shared many laughs and collaborated on some fun projects together. Thank you all for sharing your knowledge, experience and time with me. I'm so happy I kept bl00d for as long as I did.

Remain inspired, open-minded visionaries and rule-breakers.

Explore the unorthodox and the unknown.

Continue to exploit.

Master obfuscation.

Break everything.

Be free.

Teach.

Defy.

Love you guys.

Farewell.

bl00d

Source: http://nzxj65x32vh2fkhk[.]onion/p8ittuomm

In less than two weeks, chatter about a new forum called Apex emerged along with others saying the forum is not to be trusted. A member posted the following link on a discussion thread. Note the instruction to completely disregard a previous post.

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256

Date: Thursday, Oct 5th 2017

This is bl00d of Claymore, formerly the moderator at Ex0du$. Myself and several top members of Ex0du$ have banded together to create Apex.

Disregard this paste: http://nzxj65x32vh2fkhk.onion/p8ittuomm

I created it several days before deciding to start Apex. The paste will expire in 2 weeks.

Claymore (http://claymormoeepchui.onion/) now redirects to Apex as it my primary project.

Trolls and other forums seek to destroy our beautiful creation while it's still in beta. They don't know we built Apex to be indestructable.

http://apexxbboaqnsduxx.onion/

bl00d

Source: http://apexxbboaqnsduxx[.]onion/verified.txt

Is Apex run by law enforcement?

While many former Ex0du$ members immediately shifted to Apex, applying for membership requests, others are more skeptical and a series of DeepPaste posts appeared, suggesting that the site is a honeypot, a trap setup by U.S. law enforcement or, as they’re referred to on the darknet, LEA.

Apex Hacking Forum Login Screen - http://apexxbboaqnsduxx.onion

While one post could be considered “trolling” attempting to delegitimize the site, more than one makes a user stop and think, especially when you notice that the PGP signatures of the two separate posts by the admin, bl00d, do not actually match.

What does this mean?

Tor is changing dramatically as law enforcement step up their operations. Minutes ago, a paste appeared saying that KickAss Marketplace, another legacy darknet site known for providing corporate threat intelligence to hackers, is also compromised and admin is in custody.